KVKK Disclosure

⚠️ This text is not yet complete: the fields in square brackets will be filled in before release.

1. About this notice

In brief: To create your account, pass your appointment on to the Business and keep you informed about your appointment, we process your full name, email address, phone number and appointment details. The Business you book with sees your full name, your phone number, the details of the appointment and, if you wrote one, your note; it does not see your email address. Your data is hosted on the servers of service providers located abroad. We do not use advertising, tracking or third-party analytics tools. Your rights and how to apply to us are set out in Section 9.

This notice has been prepared under Article 10 of Law No. 6698 on the Protection of Personal Data (in this notice, the "KVKK" or the "Law"). It is for information only; it is not a contract or a declaration of consent, and you are not asked to approve or accept it. Where a processing activity depends on your explicit consent, that consent is requested through a separate text (the Explicit Consent Text) and a separate declaration. Retention periods, the data kept on your device and the records that remain after you delete your account are explained in the Privacy Policy.

In this notice, "we" means the data controller identified in Section 2; "Platform" means the Randevi (customer app) and Randevi Business (business app) mobile applications, the website at randevi.org and the services provided through them; "Customer" means a person who searches for businesses and books appointments through the Platform; "Business" means a workplace that accepts appointments through the Platform; and "Business user" means a person who uses Randevi Business as the owner, manager or specialist of a Business. If you are both a Customer and a Business user, both Section 4 and Section 5 apply to you.

This English text is a translation provided for convenience. The Turkish text prevails; in the event of any conflict between the Turkish and the English text, the Turkish text shall apply.

2. Identity of the data controller

Data controller: Nihat Basmacı (sole proprietorship)

Address: Mimar Sinan Mahallesi, 194. Sokak, Güzelbahçe Sitesi, No: 7-9, Atakum / Samsun

Email address: destek@randevi.org

Website: randevi.org

3. Who is responsible for which data

3.1. Data for which we are the data controller. We determine the purposes and means of processing for your account, the appointments you create through the Platform, notifications, reviews, usage measurement, Business applications and subscription records; we are the data controller for this data (Sections 4 and 5).

3.2. Data for which the Business is a separate data controller. The information needed to carry out your appointment is passed on to the Business you book with (7.1). When the Business uses this information for its own activities, for example to provide the service or to contact you about your appointment, it is a separate data controller, independent of us. Communication outside the Platform, such as a phone call or a WhatsApp message that the Business starts from its own device, is the responsibility of the Business.

3.3. Data we process on behalf of the Business. The Business enters the following records into Randevi Business by its own decision. The Business concerned is the data controller for these records; we are a data processor, processing this data on behalf of the Business solely in order to provide software services to it.

a) Manually added customer record: the full name of a person who has no account on the Platform or who booked by phone or in person, that person's phone number if the Business enters it, and the appointments the Business creates on that person's behalf.

b) Internal customer note: a short note that the Business writes about one of its customers for its own use. Only the users of that Business can see this note; the Customer cannot see it in the app.

c) Team records: the name and title, weekly working hours and time-off records (the time-off period and the type of time off) that the Business enters for its specialists. Section 5.4 also applies to a specialist's name and title. Selecting "Sick" ("Rapor" in the Turkish interface) as the type of time off constitutes health data; entering that record and meeting the conditions in Article 6 of the Law are the responsibility of the Business.

We do not use this data for our own purposes beyond the operations required by the service we provide to the Business, and we do not send notifications through the Platform to manually added persons. Informing these persons and responding to their requests under Article 11 of the Law are obligations of the Business concerned. This processing is carried out in accordance with the data processing provisions of the contract between the Business and us.

4. Customers: data processed, purposes and legal bases

For each processing activity, the data processed, the purpose and the legal basis are set out together. The legal bases are the sub-paragraphs of the second paragraph of Article 5 of the Law and are abbreviated as follows: Art. 5/2-c (contract): processing is necessary, provided that it is directly related to the conclusion or performance of the Terms of Use to which you are a party; Art. 5/2-ç (legal obligation): processing is necessary for us to comply with our legal obligation; Art. 5/2-e (protection of a right): processing is necessary for the establishment, exercise or protection of a right; Art. 5/2-f (legitimate interest): processing is necessary for our legitimate interests, provided that it does not harm your fundamental rights and freedoms.

4.1. Account and authentication. Data: your full name, email address, mobile phone number, a hash of your password (your password itself is not stored), verification and password reset codes, your language preference and your session records (including IP address and device and browser information). Purpose: to create your account, verify your identity and protect your account against unauthorised access. Legal basis: Art. 5/2-c (contract); for session security, Art. 5/2-f (legitimate interest).

4.2. Sign in with Google or Apple. If you choose one of these methods, the relevant provider verifies your identity and sends us the following: Google sends your name, your email address, your Google account identifier and the link to your profile photo; Apple sends your email address (or, if you chose its email-hiding feature, the relay address Apple created for you), your Apple account identifier and, on first sign-in only, your full name. Purpose: to create your account and let you sign in. Legal basis: Art. 5/2-c (contract).

4.3. Appointments. Data: the appointment code, the Business, the specialist, the services you selected (name, duration, price), the date and time, the total amount and duration, the channel through which the appointment was made, its status and history (request, confirmation, rejection, cancellation, time change, completed or no-show mark, and the time of each), together with your full name and phone number. Purpose: to create the appointment, pass it on to the Business, change it, cancel it and show its history to you and to the Business. Legal basis: Art. 5/2-c (contract).

We calculate your total number of appointments at a Business, the number of appointments you did not attend and the date of your last visit, and show them only to that Business; no automatic restriction is applied to you on the basis of this information. If the Business marks you as a no-show for an appointment, you are sent a notification. Legal basis: Art. 5/2-f (legitimate interest).

4.4. Appointment note and cancellation reason. When booking you may write a short note to be passed on to your specialist, and when cancelling you may write a reason. These fields are optional; what you write is shown to the Business concerned. Purpose: to convey your request to the Business. Legal basis: Art. 5/2-c (contract). We do not ask you for special categories of personal data such as your health condition; please do not write such information in these fields or in your reviews. Note and reason texts are kept in the appointment record for as long as your account remains open; they are deleted when you delete your account.

4.5. Notifications and reminders. Data: notification records (type of notification, appointment code, Business name, appointment time, specialist name, any reason written by the Business, time read), your email address, your notification preferences and, on mobile devices where push notifications are enabled and if you have granted notification permission, your device's notification token, its platform and the time it was last seen. Purpose: to inform you in the app, by push notification and by email of the confirmation, rejection, cancellation or time change of your appointment, and to remind you of your appointment. Legal basis: Art. 5/2-c (contract). Notifications about the status of your appointment cannot be turned off; you can turn off reminders on the Notification Preferences screen and push notifications in your device settings. In the mobile app, the notification infrastructure is initialised when the app is opened; the device token is recorded and linked to your account after you grant notification permission and sign in.

After a completed appointment you are sent a notification reminding you to write a review; you can turn this off with the Reminders preference. Legal basis: Art. 5/2-f (legitimate interest).

4.6. Profile photo, favourites and preferences. You may optionally upload a profile photo, add Businesses to your favourites and set your language and notification preferences. Purpose: to make your profile and preferences available across your devices. Legal basis: Art. 5/2-c (contract). Your profile photo is not shared with Businesses; however, the file is kept in a storage area where anyone who knows its link can view it.

4.7. Reviews. The rating you give and the comment you write for a completed appointment are published publicly on the Business's page, together with the date and the name of the service in the appointment; your name is shortened as in the example "Ayşe K.". The Business may nevertheless work out who wrote the review from the date and service information. Purpose: to let you share your experience with other users and to calculate the Business's rating. Legal basis: Art. 5/2-c (contract).

4.8. Reporting a review and content moderation. When you report a review as inappropriate, your account, the reason you selected, the note you wrote, a copy of the review's rating and text at that moment and the decision taken are recorded; the fact that you made the report is shown neither to the author of the review nor to the Business. If your own review is reported, a copy of its text at that moment is kept in the moderation record; a review that is taken down is not deleted but hidden. Purpose: to examine content that is unlawful or contrary to the publication rules and to take it down. Legal basis: Art. 5/2-f (legitimate interest) and Art. 5/2-e (protection of a right).

4.9. Location. If you allow it, your device's current location is sent to our servers in order to find the province, district and Businesses nearest to you and to sort them by distance. Your location is processed only for the duration of that query; it is not saved to your account and is not stored, and location is not collected in the background. If you do not allow it, you can continue to use the Platform by selecting a city. Legal basis: Art. 5/2-c (contract; providing the feature you requested).

4.10. Usage measurement. We record which screens are viewed and which steps are completed (for example registration, viewing a Business page, selecting a time, requesting an appointment). Data: the name and time of the event, its technical parameters (for example the identifier of the Business viewed), app and platform information, a session number generated at random each time the app is opened and, if you are signed in, a hash value derived from your account identifier. The text of the query you type in the search box and of the reason you write when cancelling an appointment does not enter these records; only the number of search results and whether a reason was written are recorded. Name, email, phone and location fields are also filtered out before sending. These records are not anonymous: we can re-associate the hash value with your account. Measurement also takes place for visitors who browse the Platform without an account (without an account hash). The records are not sent to any third-party analytics tool; they are kept in our own database and deleted after 180 days. When you delete your account, the records that can be linked to your account are deleted without waiting for that period. Purpose: to measure how the Platform works and to identify errors and areas for improvement. Legal basis: Art. 5/2-f (legitimate interest). You can send us your objection to usage measurement through the channels in Section 9.

4.11. Security and error detection. Data: short-lived counter records linked to your account for applying request rate limits, short-lived records that prevent the same appointment request from being processed twice, and verification email sending counters (with a hash value instead of your email address itself). When an error occurs in the web version, the error message, the technical error trace and browser information are recorded in the logs of our web hosting provider; the mobile apps do not send error reports. Purpose: to protect the Platform against abuse, duplicate records and overload, and to detect and fix errors. Legal basis: Art. 5/2-f (legitimate interest).

4.12. Support and applications. When you write to us by email, your email address, what you write and the technical information the app adds to the message (app name and version, operating system version, language) are processed in order to answer your request. Legal basis: Art. 5/2-c (contract); for answering your applications under Article 11 of the Law, Art. 5/2-ç (legal obligation).

4.13. Declaration and preference records. When you register by email, your declarations that you accept the Terms of Use and that you have read this notice, together with your campaign message preference, are recorded. Where the app offers sign-in with Google, Apple or a phone number and you sign in that way, your continuing after the notice shown on the sign-in screen (that by continuing you accept the Terms of Use and confirm that you have read this notice) is also recorded, unless these declarations are already recorded on your account, as a declaration of acceptance of the Terms of Use and of having read this notice; on these routes your campaign message preference is neither asked for nor recorded. Afterwards, every change to your campaign message preference is recorded as well. Each record contains the type of the declaration, its time, the screen on which it was made and the version of the text shown to you. The declaration relating to this notice shows only that the notice was read; it is not an approval or consent. Purpose: to be able to prove your declarations and preferences and to comply with your preferences. Legal basis: Art. 5/2-ç (legal obligation) and Art. 5/2-e (protection of a right). These records are kept for as long as your account remains open; they are deleted when you delete your account.

4.14. Campaign and announcement messages. Sending you messages containing campaigns, promotions or announcements depends solely on an approval that you give separately. This approval is not a condition of opening an account, is off by default and is explained in the Explicit Consent Text; this notice does not take the place of that approval. Legal basis: the first paragraph of Article 5 of the Law (explicit consent) and your approval under Article 6 of Law No. 6563 on the Regulation of Electronic Commerce. You can withdraw your approval at any time on the Notification Preferences screen.

4.15. Use without an account. Without opening an account you can search for Businesses and view their pages and available times. In that case no profile is created for you on our servers; only the location query and usage measurement described in 4.9 and 4.10 take place.

5. Business users: data processed, purposes and legal bases

This section is for those who use Randevi Business as the owner, manager or specialist of a Business. The explanations in 4.1, 4.2, 4.6 and 4.10 to 4.14 also apply to you; only the processing specific to the Business side is set out below.

5.1. Membership, role and team invitations. Data: the Business you are a member of, your role (owner, manager or specialist) and your membership date; when a team invitation is created, the contact detail written for the invited person (phone or email), the role, status and expiry time of the invitation, and the accounts that created and accepted it. We do not send the invitation link; the person who creates the invitation shares it. Other users of the same Business can see your membership and role. Purpose: to manage authorised access to the Business account. Legal basis: Art. 5/2-c (contract).

5.2. Application and identity information. Data: the legal name of the Business (for a sole proprietorship, the full name), the tax office, the tax identification number or, for a sole proprietorship, the Turkish national identity number, the tax certificate document, the version and time of your contract approval, the application and decision dates and, if any, the reason for rejection. Purpose: to verify the applying Business, to establish the contract between the Business and us, and to provide a basis for our financial records. Legal basis: Art. 5/2-c (contract); for financial records and for evidence in possible disputes, Art. 5/2-f (legitimate interest). This information is not public; only the owner and manager of the Business and our authorised staff who review the application can see it.

5.3. Public Business profile. The Business's name, category, description, address, map location, phone, email address, Instagram and website links, photos, services, working hours and the reviews it receives are public, including to visitors without an account, from the moment the Business is published. A closed Business is removed from search and discovery; its profile, however, may still be viewed by anyone who has its link. When the last user of a closed Business also deletes their account, the profile is taken down and is no longer shown to anyone other than our authorised staff; the phone number, email address and Instagram and website links on the profile and the photo files are deleted, and the rest of the profile is kept together with the Business's record (details are in paragraphs 13.14 and 14.8 of the Privacy Policy). For sole proprietorships this information may belong to a natural person. The map location is determined by your marking it on the map or, if you allow it, by your device's location. Purpose: to enable Customers to find the Business and book appointments. Legal basis: Art. 5/2-c (contract).

5.4. Specialist records, working hours, time off and reports. The owner or manager of the Business enters the name and title, weekly working hours and time-off records for specialists (3.3). A specialist's name and title are shown publicly on the Business page and appear in the appointment notifications sent to Customers; we too are a data controller for this display and these notifications. Legal basis: Art. 5/2-f (legitimate interest; matching the appointment with the right specialist and informing the Customer).

Working hours and time-off records are visible only to the users of the same Business. The owner and manager of the Business also see reports showing, per specialist, the number of appointments, the number of no-shows, booked time, revenue and occupancy rate; a specialist sees only their own row. Purpose: to calculate available times, to assign appointments to the right specialist and for the Business's work planning. The Business is the data controller for working hours, time off and reports; determining their legal basis and informing its specialists are obligations of the Business. When a specialist opens an account and accepts the invitation, 4.1 applies to their own account data.

5.5. Subscription. Data: the Business's plan and period information, subscription status, and trial and period end dates. We do not receive or store payment card information. Purpose: to set up the subscription and to determine the Business's right of access to the Platform. Legal basis: Art. 5/2-c (contract).

5.6. Referral code. If you optionally enter a representative's code in your application, the code you typed and the link between the Business and the representative are recorded. Purpose: to identify the representative who referred the Business and to calculate the share payable to the representative. Legal basis: Art. 5/2-f (legitimate interest).

5.7. Replies to reviews and reporting a review. The reply you write to a review is published publicly; the name of the person who wrote the reply is not shown. When you report a review, your account, the reason, your note and a copy of the review at that moment are recorded for examination. Legal basis: Art. 5/2-c (contract) and Art. 5/2-f (legitimate interest).

5.8. Business notifications. In-app and push notifications are sent for events such as a new appointment request, a cancellation, a review, the outcome of an application and subscription status; the owner of the Business is also sent a daily summary and emails about account and subscription events. For this purpose your notification records, your notification preferences, your email address and, if you have granted notification permission, your device's notification token are processed. The push notifications sent to you do not contain the Customer's name or phone number. Legal basis: Art. 5/2-c (contract).

5.9. Closing a Business and transferring ownership. The account that closes or transfers the Business, the time of the operation and the reason written are recorded in order to document by whom and when the operation was carried out. Legal basis: Art. 5/2-c (contract) and Art. 5/2-e (protection of a right).

6. How we collect your data

Your personal data is collected electronically and by automatic means, through the Randevi and Randevi Business mobile apps and the randevi.org website, via the forms you fill in and the actions you take. Because our staff are also involved in operations such as support correspondence and the review of Business applications, those operations are partly automatic.

Your data is also obtained in the following ways: from the relevant identity provider when you sign in with Google or Apple; from a Business when it adds you to its own records, creates an appointment on your behalf or registers you as a specialist; and by email when you write to us.

7. To whom and for what purpose we transfer your data

7.1. The Business you book with. Your full name, your phone number, the details of the appointment and, if you wrote them, your appointment note and cancellation reason are shown to the owner and manager of that Business, and to specialists only for their own appointments. Purpose: to carry out the appointment and to contact you about it. Legal basis: Art. 5/2-c (contract). Your email address, profile photo, favourites, notifications and your appointments at other Businesses are not shared with the Business.

7.2. Public content. Your reviews (4.7), the Business profile (5.3) and specialists' names and titles (5.4) can be seen by anyone who visits the Platform.

7.3. Infrastructure providers we use. Your data is transferred to the following providers, whose services we use to run the Platform, solely for the purpose of providing the service stated:

a) Hosting and infrastructure (Supabase, Inc.): the database, authentication, file storage and server functions are with this provider; all data processed on the Platform is hosted there.

b) Email delivery (Resend): your email address and the content of the message are transferred in order to send emails containing verification codes, password resets and appointment or account notifications.

c) Push notifications (Google LLC, Firebase Cloud Messaging; Apple Inc. for delivery to iOS devices): your device's notification token, the title and text of the notification (Business name, appointment time, specialist name, any reason written by the Business) and the appointment code are transferred.

d) Web hosting (Vercel Inc.): your IP address and browser information are processed by the hosting provider when the randevi.org website is served; error records from the web version (4.11) are written to this provider's logs.

e) Email inbox ([EMAIL INBOX PROVIDER]): the support and application messages you send us (4.12) are kept in this provider's mailbox.

7.4. Identity providers (Google LLC, Apple Inc.). Only if you choose to sign in with these methods, your sign-in request is directed to the relevant provider and the information listed in 4.2 is received from the provider. These providers' processing of data about you is subject to their own privacy terms. The profile photo in your Google account is loaded from Google's servers.

7.5. Map provider (OpenStreetMap). When you open the map view, map images are requested by your device directly from the map provider's servers; in doing so your IP address, app information and the area of the map you are looking at are transmitted to those servers. Your account identifier and device location are not transmitted.

7.6. Competent institutions and authorities. Upon duly made requests from public institutions and organisations authorised by law and from judicial authorities, the requested data is shared, limited to the request. Legal basis: Art. 5/2-ç (legal obligation).

7.7. Your data is not transferred to any recipient or for any purpose other than those listed in this section.

8. Transfers abroad

The infrastructure providers listed in 7.3 above process your data on servers located abroad. Your personal data is therefore transferred abroad within the meaning of Article 9 of the Law.

The transfers are made to the following locations: for the database, authentication and file storage provided by Supabase, currently South Korea (Seoul); for email delivery, the United States of America (Resend); for web hosting, the United States of America (Vercel); for push notifications, the servers of Google and Apple located abroad; for the email inbox, [EMAIL INBOX HOSTING LOCATION].

Because these transfers are made continuously for the operation of the Platform, they are not based on your explicit consent. Transfers to the providers listed in 7.3 are carried out, in addition to the conditions in Article 5 of the Law stated in this notice for each processing activity, under [CROSS-BORDER TRANSFER BASIS].

When you choose to sign in with Google or Apple, your sign-in request, and when you open the map view, the information listed in 7.5, is transmitted to these providers, which are established abroad. In these two cases, the basis under Article 9 of the Law is: [IDENTITY AND MAP PROVIDERS TRANSFER BASIS].

9. Your rights and how to apply

You can exercise your rights under Article 11 of the Law (including the right to learn whether your data is processed, to request its correction or deletion, to know the persons to whom it is transferred, to object to a result to your detriment arising from analysis carried out solely by automated systems, and to claim compensation for your loss) through the channels below.

You can update your profile information, edit or delete your reviews (except those that have been taken down), withdraw your campaign message approval, close your sessions on all devices and delete your account yourself, within the app. You can send us your other requests in Turkish through one of the following channels:

a) by signed petition, delivered by hand or sent by post to the following address: Mimar Sinan Mahallesi, 194. Sokak, Güzelbahçe Sitesi, No: 7-9, Atakum / Samsun;

b) to destek@randevi.org, using a secure electronic signature or mobile signature;

c) by sending an email to destek@randevi.org from the email address registered to your account on the Platform.

Your application must contain your full name, your signature if the application is in writing, your Turkish national identity number (or, if you are a foreign national, your nationality and your passport number or, if any, your identity number), your residential or workplace address for notifications, your email address, telephone and fax number for notifications if any, and the subject of your request.

We conclude your application free of charge as soon as possible and within thirty days at the latest, and notify you of our reply in writing or electronically; if we refuse your request, we explain the reason. If the operation requires an additional cost, the fee in the tariff set by the Personal Data Protection Board may be charged.

If your request is refused, if you find our reply insufficient or if you do not receive a reply in time, you may lodge a complaint with the Personal Data Protection Board within thirty days from the date you learn of the reply and in any event within sixty days from the date of your application.

For processing where the Business is a separate data controller (3.2) and for records we process on behalf of the Business (3.3), you may also send your requests directly to the Business concerned. We forward requests on these matters that reach us to the Business concerned, and we notify the Business to which we transferred your data of the corrections and deletions we make in our own records.

10. Changes to this notice

We update this notice when there is a change in our data processing activities or in the legislation. Where a new group of recipients or a new service provider is involved, we publish the updated notice before the change is applied. Before we begin processing your data for a new purpose, we do not merely publish the updated notice; we also inform you separately, through your registered email address or by in-app notification.

You can reach the current notice from the Legal screen in the Profile section of Randevi, from the Legal screen in the Settings section of Randevi Business, and at randevi.org/yasal/en/kvkk. The text in the mobile apps is refreshed with app updates; the most up-to-date text is at this web address.

Last updated: [EFFECTIVE DATE]

Version: 1.0